
Australian Government 
National Health and Medical Research Council 


Application of the Guidelines under Section 95 of the 
Privacy Act 1988 (2014) 


Background 

The Guidelines under Section 95 of the Privacy Act 1988 (s95 Guidelines) provide a framework for the conduct of 
medical research using information held or collected by agencies where personal information needs to be used and 
where it is not practicable to obtain the individual’s consent. In these situations, an agency may collect, use or 
disclose records containing personal information for medical research purposes without breaching the Privacy Act if 
the proposed medical research has been approved by a properly constituted Human Research Ethics Committee 
(HREC) in accordance with the s95 Guidelines. 

This form provides a template for researchers and HRECs to satisfy the data custodian that the s95 Guidelines 
have been appropriately applied and provide evidence that the HREC has the necessary qualifications and/or 
experience to consider privacy issues. 

This template can be manipulated to suit the purposes of any Commonwealth agency which acts as a data 
custodian. 


Instructions 

This form should be accompanied by the HREC application and proof of the HREC decision. 

Part A - to be completed by the responsible researcher 

Parts B and C - to be completed by the approving HREC Chairperson 

Both the researcher and the Chairperson are required sign the declaration at Part D. 


Disclaimer 

Submission of this form does not guarantee release of the data. In accordance with paragraph 1.3 of the s95 

Guidelines, agencies can decide to decline to disclose personal information for use in medical research even 
where the medical research has been approved by an HREC in accordance with these guidelines. 
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Part A - Breach of one or more APPs 

Researcher to complete 

Q.1: Under paragraph 2.3 of the s95 Guidelines, when research may involve a breach of one or more APPs, the 
proposal for that research to be submitted to an HREC must contain a reference to the APP(s) and must also 
state reasons for believing that the public interest in the research outweighs, to a substantial degree, the 
public interest in complying with the APP(s). Please identify the APPs which may be breached by the 
proposed research and provide your reasons below: 

n APP1 - open and transparent management of personal information 

Reason(s) _ 


□ APP2 — anonymity and pseudonymity 

Reason(s) _ 


n APP3 — collection of solicited personal information 

Reason(s) _ 


l~l APP4 — dealing with unsolicited personal information 

Reason(s) _ 


l~l APP5 — notification of the collection of personal information 

Reason(s) _ 


n APP6 — use or disclosure of personal information 

Reason(s) _ 


D APP7 — direct marketing 

Reason(s) _ 
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□ APP8 — cross-border disclosure of personal information 

Reason(s) _ 


n APP9 — adoption, use or disclosure of government related identifiers 

Reason(s) _ 


|~| APP10 — quality of personal information 

Reason(s) _ 


Q APP11 — security of personal information 

Reason(s) _ 


□ APP12 — access to personal information 

Reason(s) _ 


l~l APP13 — correction of personal information 

Reason(s) _ 
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Part B - HREC Expertise 

HREC Chairperson to complete 

Q.2: Before making a decision under the s95 Guidelines, the HREC must assess whether it has sufficient 
information, expertise and understanding of privacy issues, either amongst the members of the HREC or 
otherwise available to it, to make a decision that takes proper account of privacy (refer to paragraph 3.1 of the 
s95 Guidelines). Please provide details of the HREC’s qualifications and/or experience to consider 
privacy issues below: 
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Part C - Weighing the public interest 

HREC Chairperson to complete 

The HREC must ensure that the committee has the competence to determine if the public interest in the 

proposed research outweighs, or does not outweigh, to a substantial degree, the public interest in the 

protection of privacy (refer to Section 3 of the s95 Guidelines). 

Has the HREC considered: 

(a) the degree to which the medical research is likely to contribute to: 

• the identification, prevention or treatment of illness or disease 

• scientific understanding relating to health 

• the protection of the health of individuals and/or communities 

• the improved delivery of health services 

• scientific understanding or knowledge 

(b) any likely benefits to individuals, to the category of persons to which they 
belong, or the wider community that will arise from the medical research being 
undertaken in the manner proposed 

(c) whether the medical research design can be satisfied without risking infringement of Y □ N l~l 

an APP and the scientific defects in the medical research that might arise if the 
medical research was not conducted in the manner proposed 

(d) the financial costs of not undertaking the medical research (to government, the Y □ N l~l 

public, the health care system, etc.) 

(e) the public importance of the medical research Y □ N □ 

(f) the extent to which the data being sought are ordinarily available to the public from Y Q N Q 

that agency 

i. whether the medical research involves use of data in a way which is 
inconsistent with the purpose for which the data was made public 

ii. whether the medical research requires an alteration of the format of the data 
of a kind that would, if used by an agency, involve a breach of an APP 

g) whether the risk of harm to a person whose personal information is to be used in 
proposed research is minimal, having regard to the elements of that research 
provided in response to paragraph 2.3 of these guidelines 

h) the standards of conduct that are to be observed in medical research, including: 

i. the study design and the scientific credentials of the researchers 

ii. if the research involves contact with participants, the procedures or controls 
which will apply to ensure that participants are treated with integrity and 
sensitivity, including whether questions to be asked or procedures to be 


Y □ N □ 


Y □ N □ 


Y □ N □ 


Y □ N □ 
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employed are intrusive 

iii. whether access to personal information is restricted to appropriate 
researchers 

iv. the risk that a person or group could be identified in the published results 

v. the procedures that are to be followed at the completion of the research to 
ensure that all data containing personal information are at least as secure as 
they were in the sources from which the data were obtained, including the date 
when the data will be destroyed or returned. 

Part D - Declaration 

By signing below, the researcher and HREC Chairperson are making the declaration that the information 
provided in this form is true and correct. 


Researcher 

Print name 


Signature 


Date 


HREC Chairperson 

Print name 


Signature 


Date 
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